สร้าง REST API ระบบ Login ด้วย Slim framework 4

CREATE TABLE `tbl_users` (
  `user_id` int(11) NOT NULL,
  `user_email` varchar(100) NOT NULL,
  `user_password` varchar(255) NOT NULL,
  `user_name` varchar(100) NOT NULL,
  `user_cratedate` datetime NOT NULL DEFAULT current_timestamp(),
  `user_lastlogin` datetime NOT NULL,
  `user_active` tinyint(1) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ALTER TABLE `tbl_users`
  ADD PRIMARY KEY (`user_id`),
  ADD KEY `user_email` (`user_email`);

ALTER TABLE `tbl_users`
  MODIFY `user_id` int(11) NOT NULL AUTO_INCREMENT;
COMMIT;

composer require firebase/php-jwt:5.5.1

use \Firebase\JWT\JWT;

require __DIR__ . '/./app/UserController.php';

// กำหนด service ให้กับ container ใช้งาน mysql
$container->add('db', function () {
    $mysqli = new mysqli("localhost", "root","","test");  
    if ($mysqli->connect_errno) exit();
    if (!$mysqli->set_charset("utf8")) exit();  
    return $mysqli;
});
// กำหนด service ให้กับ container ใช้งาน jwt
$container->add('jwt', function () {
    $jwt = new JWT;
    return $jwt;
});
// กำหนด container ไปใช้งานใน cobntroller
$container->add('UserController', function ($container) {
    return new UserController($container);
});

// Routing ใช้การจัดกลุ่ม
$app->group('/user', function (RouteCollectorProxy $group) {
    $group->get('[/{id:[[:digit:]]+}]', '\UserController'); // ดึงข้อมูล   
    $group->post('/authen', '\UserController:authen'); // ล็อกอิน
    $group->post('/create', '\UserController:create'); // สมัครสมาชิก
});

<?php
use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use Slim\Factory\AppFactory;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Log\LoggerInterface;
use Slim\Routing\RouteCollectorProxy;
use \Firebase\JWT\JWT;
 
require __DIR__ . '/./vendor/autoload.php';

require __DIR__ . '/./app/UserController.php';
 
// สร้าง Container โดยใช้ League Container
$container = new League\Container\Container();
 
// กำหนดการใช้ Container สำหรับร่วมกับการสร้าง app
Slim\Factory\AppFactory::setContainer($container);
$app = AppFactory::create();
$app->setBasePath('/demo/api');
 
// กำหนด service ให้กับ container ใช้งาน mysql
$container->add('db', function () {
    $mysqli = new mysqli("localhost", "root","","test");  
    if ($mysqli->connect_errno) exit();
    if (!$mysqli->set_charset("utf8")) exit();  
    return $mysqli;
});
// กำหนด service ให้กับ container ใช้งาน jwt
$container->add('jwt', function () {
    $jwt = new JWT;
    return $jwt;
});
// กำหนด container ไปใช้งานใน cobntroller
$container->add('UserController', function ($container) {
    return new UserController($container);
});
 
 
// กำหนดรุปแบบ Error Handler เอง
$customErrorHandler = function (
    ServerRequestInterface $request,
    Throwable $exception,
    bool $displayErrorDetails,
    bool $logErrors,
    bool $logErrorDetails,
    ?LoggerInterface $logger = null
) use ($app) {
 
    $payload = ['error' => $exception->getMessage()];
 
    $response = $app->getResponseFactory()->createResponse();
    $response->getBody()->write(
        json_encode($payload, JSON_UNESCAPED_UNICODE)
    );
    return $response
              ->withHeader('Content-Type', 'application/json');
};
// Error Middleware
$errorMiddleware = $app->addErrorMiddleware(false, true, true);
$errorMiddleware->setDefaultErrorHandler($customErrorHandler); // เรียกใช้งานรูปแบบที่กำหนด
 
// Routing ใช้การจัดกลุ่ม
$app->group('/user', function (RouteCollectorProxy $group) {
    $group->get('[/{id:[[:digit:]]+}]', '\UserController'); // ดึงข้อมูล   
    $group->post('/authen', '\UserController:authen'); // ล็อกอิน
    $group->post('/create', '\UserController:create'); // สมัครสมาชิก
});
  
$app->run();

<?php
use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;

class UserController
{
   private $container;

   public function __construct($container)
   {
       $this->container = $container;
   }
 
   public function __invoke(Request $request, Response $response, array $args)
   {

   }

   public function authen(Request $request, Response $response, array $args)
   {

   }   

   public function create(Request $request, Response $response, array $args)
   {          

   }  
   
}

$this->container->get('db');
$this->container->get('jwt');   

<?php
/** Error reporting */
error_reporting(0);
ini_set('display_errors', FALSE);
ini_set('display_startup_errors', FALSE);

use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;

class UserController
{
   private $container;
   // ส่วนของการกำหนด JWT
   private $secret_key = 'this_is_secret_key';
   private $issuer_claim = "localhostTest"; // this can be the servername
   private $audience_claim = "https://localhostTest";
   private $issuedat_claim; 
   private $notbefore_claim; 
   private $expire_claim; 

   public function __construct($container)
   {
       $this->container = $container;
       // ส่วนของการกำหนด JWT
       $this->issuedat_claim = time(); // เวลาที่ออก Token
       $this->notbefore_claim = time(); // ถ้า 60 (1 * 60) ใช้งานได้หลังจาก 1 นาที
       $this->expire_claim = time() + 600000; // ถ้า 300 (5 * 60) เท่ากับ หมดอายุใน 5 นาที

   }
 
   public function __invoke(Request $request, Response $response, array $args)
   {
        $data = [];
        $db = $this->container->get('db');
        $jwt = $this->container->get('jwt');   
        if ($request->hasHeader('Authorization')) { 
            $authorize = $request->getHeaderLine('Authorization');
            list($bearer, $jwt_token) = explode(" ",$authorize);
            if($jwt_token){
                try {
                    $decoded = (array)$jwt::decode($jwt_token, $this->secret_key, array('HS256')); 
                    $id = $decoded['data']->id; 
                }catch (Exception $e){ // ถอดรหัส token ไม่ผ่านหรือหมดอายุ
                    $errMsg = "Invalid token Access denied";
                }                     
            }      
        }else{
            $errMsg = "Access denied";
        }
        if(!isset($args['id']) || (int)$args['id'] == 0){
            $errMsg = "Not valid user id";
        }
        if(isset($id) && $id != (int)$args['id']){ // ดึงข้อมูลได้เฉพาะ id ของตัวเอง
            $errMsg = "Access denied";
        }
        if(!isset($errMsg)){  
            $sql = "
            SELECT * FROM tbl_users WHERE 1 
            ";
            if(isset($args['id'])){ // ถ้ามีการส่งค่า id มา
                $sql.= " AND user_id='".(int)$args['id']."' ";
            }
            $result = $db->query($sql);
            if( $result && $result->num_rows > 0 ){
                $data = $result->fetch_all(MYSQLI_ASSOC); // ดึง array ข้อมูลสมาชิกไปใช้งาน
            }
        }
        if(isset($errMsg)){ // ถ้ามี error
            $data = [
                "error" => $errMsg
            ];               
        }             
        $payload = json_encode($data);
    
        $response->getBody()->write($payload);
        return $response
                ->withHeader('Content-Type', 'application/json');
   }

   public function authen(Request $request, Response $response, array $args)
   {
        $body = $request->getBody();
        // แปลงข้อมูลที่ส่งมาเป็น array
        $_post = json_decode($body->getContents(), TRUE); 

        $data = [];
        $db = $this->container->get('db');
        $jwt = $this->container->get('jwt');
        if ($request->hasHeader('content-type') 
            && preg_match('/application\/json/',$request->getHeaderLine('Content-Type'))) { 
            if(trim($_post['email'])=="" ||  trim($_post['password'])==""){
                $errMsg = "Email and Password are required";
            }else{
                if(!$this->valid_email($_post['email'])){
                    $errMsg = "Email Invalid";
                }
                if(strlen($_post['password']) < 8 || strlen($_post['password']) > 14){
                    $errMsg = "Password length between 8 and 14 characters";
                }        
            }
        }else{
            $errMsg = "Expected content-type \"JSON\" doesn't match actual content-type ".$request->getHeaderLine('content-type');
        } 
        if(!isset($errMsg)){  
            $email = trim($_post['email']);
            $password = trim($_post['password']);
			
            $sql = "SELECT user_password FROM tbl_users WHERE user_email = ? AND user_active = 1";
            $stmt = $db->prepare($sql);
            $stmt->bind_param('s', trim($_post['email']));
            $stmt->execute();
            $stmt->bind_result($user_password);					
            if ($stmt->fetch()){
		$stmt->close();
		$hashed_password_from_db = stripslashes($user_password);					
		if (!password_verify(trim($_post['password']), $hashed_password_from_db)) {
			$errMsg = "Password is not currect";
		}else{
			$sql = "
			SELECT user_id,user_email FROM tbl_users WHERE 
			user_email='".$email."' AND
			user_password='".stripslashes($user_password)."' AND
			user_active='1'
			";	
			$result = $db->query(trim($sql));
			if($result && $result->num_rows>0){  
				$row = $result->fetch_assoc();

				// ส่วนของการกำหนด token
				$token = array(
					"iss" => $this->issuer_claim,
					"aud" => $this->audience_claim,
					"iat" => $this->issuedat_claim,
					"nbf" => $this->notbefore_claim,
					"exp" => $this->expire_claim,
					"data" => array(
						"id" => $row['user_id'],
						"email" => $row['user_email'],
					)
				);
				// สร้าง token
				$jwt = $jwt::encode($token, $this->secret_key);
				$data = [
					"success" => 'Login successful',
					"jwt" => $jwt,
					"id" => $row['user_id'],
					"email" => $row['user_email'],
					"expireAt" => $this->expire_claim                    
				];
				$db->query("UPDATE tbl_users SET user_lastlogin='".date("Y-m-d H:i:s")."' WHERE user_id='".$row['user_id']."' ");
			}else{
				$errMsg = "Email or Password is not currect";
			}  
		}			
            }else{
                $errMsg = "This user email not exist";
            }				 
        }           
        if(isset($errMsg)){ // ถ้ามี error
            $data = [
                "error" => $errMsg
            ];               
        }                
        $payload = json_encode($data);
    
        $response->getBody()->write($payload);
        return $response
                ->withHeader('Content-Type', 'application/json');
   }   

   public function create(Request $request, Response $response, array $args)
   {          
        $body = $request->getBody();
        $_post = json_decode($body->getContents(), TRUE);

        $data = [];
        $db = $this->container->get('db');
        if ($request->hasHeader('Content-Type') 
            && preg_match('/application\/json/',$request->getHeaderLine('Content-Type'))) { 
            if(trim($_post['email'])=="" ||  trim($_post['password'])==""){
                $errMsg = "Email and Password are required";
            }else{
                if(!$this->valid_email($_post['email'])){
                    $errMsg = "Email Invalid";
                }
                if(strlen($_post['password']) < 8 || strlen($_post['password']) > 14){
                    $errMsg = "Password length between 8 and 14 characters";
                }
                $email = trim($_post['email']);         
                $sql = "
                    SELECT user_id FROM tbl_users WHERE user_email='".$email."'
                ";
                $result = $db->query($sql);
                if($result && $result->num_rows>0){  // คิวรี่ข้อมูลสำเร็จหรือไม่ และมีรายการข้อมูลหรือไม่
                    $errMsg = "Email already exist";
                }                
            }
        }else{
            $errMsg = "Expected content-type \"JSON\" doesn't match actual content-type";
        } 
        if(!isset($errMsg)){  
            $email = trim($_post['email']);
            $password = trim($_post['password']);
            $hashed_password = password_hash($password, PASSWORD_BCRYPT);	
            $hashed_password = addslashes($hashed_password);
            $sql_insert="
                INSERT INTO tbl_users SET 
                user_email='{$email}',
                user_password='{$hashed_password}',
                user_active='1'
            ";  
            $result = $db->query($sql_insert); // เพิ่มผู้ใช้ใหม่ในฐานข้อมูล
            if($result && $db->affected_rows>0){ 
                $data = [
                    "success" => 'Create user successful'
                ];
            }else{
                $errMsg = "Create user fail";
            }  
        }            
        if(isset($errMsg)){ // ถ้ามี error
            $data = [
                "error" => $errMsg
            ];               
        }       
        $payload = json_encode($data);
    
        $response->getBody()->write($payload);
        return $response
                ->withHeader('Content-Type', 'application/json');
   }  
   
   public function valid_email($str){
    return (!preg_match("/^([a-z0-9\+_\-]+)(\.[a-z0-9\+_\-]+)*@([a-z0-9\-]+\.)+[a-z]{2,6}$/ix", $str)) ? FALSE : TRUE;
   }
}

Content-Type: application/json
Accept: application/json

{
    "email":"test@gmail.com",
    "password": "demotest"
}

$this->notbefore_claim = time() + 60; // ใช้งานได้หลังจาก 1 นาที
$this->expire_claim = time() + 300; // หมดอายุใน 5 นาที

$this->notbefore_claim = time(); // ใช้งานได้ทันที
 $this->expire_claim = time() + (24*60*60); // หมดอายุใน 1 วัน